Strange profile in HKEY_USERS

[nitrousable]

I've noticed a strange profile in my registry named RK_Alex_ON_F_F24B.
Upon closer inspection turns out it was my old Windows profile from 2015 installation.
I have no idea how it got there. Could it be from RogueKiller since the first two letters are RK?
¤¤¤ Registry : 2 ¤¤¤
[Suspicious.Path] (X64) HKEY_USERS\RK_Alex_ON_F_F24B\Software\Microsoft\Windows\CurrentVersion\Run | MP3 Skype recorder : C:\Users\Alex\AppData\Local\MP3 Skype recorder\MP3SkypeRecorder.exe

• -> Found

[Suspicious.Path] (X86) HKEY_USERS\RK_Alex_ON_F_F24B\Software\Microsoft\Windows\CurrentVersion\Run | MP3 Skype recorder : C:\Users\Alex\AppData\Local\MP3 Skype recorder\MP3SkypeRecorder.exe

• -> Found

Like I said this profile is ancient and is not in use anymore. I'm just wondering how the heck it's still in my registry even though I reinstalled windows

[nitrousable]

Yep, looks like it is indeed from RogueKiller.
After I restarted Windows that RK_Alex_ON_F_F24B entry was gone.
But then I ran roguekiller again and it reappeared with a slightly different name along with several others "RK" ones


Curson or Tigzy I could really use your help on this one...

Like I said it's the ancient profile that is not in use on the current Windows installation but for some reasons this profile is dug up upon launching RogueKiller...
It's the first time I see anything like this

[Curson]

Hi nitrousable,

When Windows is reinstalled some parameters from the ancien installation are preserved, especially the user profiles.
During a scan, RogueKiller loads all the registry hives found the proceed to analyse them.

In your case, RogueKiller detected some registry keys related to malware in your old user profile.
You can safely delete them and move on.

Regards.

[nitrousable]

Hey appreciate it Curson...

I think I figured it out. RogueKiller actually reads from hives on different drives as well. I had an ancient Windows installation on disk F and it read from there.
It definitely wasn't the case before though. RogueKiller used to read only from hives on disk C but looks like not anymore

[Curson]

Hi nitrousable,

Yes, that's indeed the case.
I'm glad I was able to help you.

Regards.